From: Li RongQing <lirongqing@baidu.com>

sysctl_numa_balancing_scan_size was registered via debugfs_create_u32(),
which accepts any u32 value including 0. A zero value triggers
divide-by-zero in two paths:

  task_scan_min():
    windows = MAX_SCAN_WINDOW / scan_size;

  task_nr_scan_windows():
    rss = round_up(rss, nr_scan_pages);  /* undefined behavior */
    return rss / nr_scan_pages;

Replace the bare debugfs_create_u32() registration with a custom
file_operations handler that rejects writes of 0 with -EINVAL,
preventing the invalid value from ever being stored.

Fixes: 8a99b6833c88 ("sched: Move SCHED_DEBUG sysctl to debugfs")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 kernel/sched/debug.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 40584b2..3169a0d 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -633,6 +633,26 @@ static void debugfs_fair_server_init(void)
 	}
 }
 
+#ifdef CONFIG_NUMA_BALANCING
+static int numa_scan_size_get(void *data, u64 *val)
+{
+	*val = *(u32 *)data;
+	return 0;
+}
+
+static int numa_scan_size_set(void *data, u64 val)
+{
+	if (val == 0 || val > UINT_MAX)
+		return -ERANGE;
+
+	*(u32 *)data = (u32)val;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(numa_scan_size_fops, numa_scan_size_get,
+			 numa_scan_size_set, "%llu\n");
+#endif /* CONFIG_NUMA_BALANCING */
+
 static __init int sched_init_debug(void)
 {
 	struct dentry __maybe_unused *numa, *llc;
@@ -664,7 +684,8 @@ static __init int sched_init_debug(void)
 	debugfs_create_u32("scan_delay_ms", 0644, numa, &sysctl_numa_balancing_scan_delay);
 	debugfs_create_u32("scan_period_min_ms", 0644, numa, &sysctl_numa_balancing_scan_period_min);
 	debugfs_create_u32("scan_period_max_ms", 0644, numa, &sysctl_numa_balancing_scan_period_max);
-	debugfs_create_u32("scan_size_mb", 0644, numa, &sysctl_numa_balancing_scan_size);
+	debugfs_create_file("scan_size_mb", 0644, numa,
+			    &sysctl_numa_balancing_scan_size, &numa_scan_size_fops);
 	debugfs_create_u32("hot_threshold_ms", 0644, numa, &sysctl_numa_balancing_hot_threshold);
 #endif /* CONFIG_NUMA_BALANCING */
 
-- 
2.9.4

On Mon, Jul 14, 2026 at 01:30PM +0800, Li RongQing wrote:
> +	debugfs_create_file("scan_size_mb", 0644, numa,
> +			    &sysctl_numa_balancing_scan_size, &numa_scan_size_fops);

DEFINE_DEBUGFS_ATTRIBUTE() is meant to be paired with
debugfs_create_file_unsafe() rather than debugfs_create_file():
debugfs_attr_read()/write() already take removal protection via
debugfs_file_get()/put(), so debugfs_create_file() just adds a
redundant full_proxy layer. The "verbose" knob in this same file
uses debugfs_create_file_unsafe() for that reason.

> +	if (val == 0 || val > UINT_MAX)
> +		return -ERANGE;

The changelog says the value is rejected with -EINVAL, but the code
returns -ERANGE -- could you make the two consistent? -ERANGE is fine.

The write-time rejection is the right approach; just the two points above.

Thanks,
Xusheng

> On Mon, Jul 14, 2026 at 01:30PM +0800, Li RongQing wrote:
> > +	debugfs_create_file("scan_size_mb", 0644, numa,
> > +			    &sysctl_numa_balancing_scan_size, &numa_scan_size_fops);
> 
> DEFINE_DEBUGFS_ATTRIBUTE() is meant to be paired with
> debugfs_create_file_unsafe() rather than debugfs_create_file():
> debugfs_attr_read()/write() already take removal protection via
> debugfs_file_get()/put(), so debugfs_create_file() just adds a redundant
> full_proxy layer. The "verbose" knob in this same file uses
> debugfs_create_file_unsafe() for that reason.
> 
> > +	if (val == 0 || val > UINT_MAX)
> > +		return -ERANGE;
> 
> The changelog says the value is rejected with -EINVAL, but the code returns
> -ERANGE -- could you make the two consistent? -ERANGE is fine.
> 
> The write-time rejection is the right approach; just the two points above.
> 

Thanks, I will send v2 with your advice.


[Li,Rongqing] 


> Thanks,
> Xusheng